CVE-2025-54805
Full vulnerability record from the local CVENow database.
Description
When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity
MEDIUM
CVSS score
6.0
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-15 14:15:49.810000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-54805",
"sourceIdentifier": "[email protected]",
"published": "2025-10-15T14:15:49.810",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
},
{
"lang": "es",
"value": "Cuando se configura un iRule en un servidor virtual a través de la API declarativa, tras la reinstanciación, el proceso de limpieza puede causar un aumento en la utilización de los recursos de memoria del Microkernel de Gestión de Tráfico (TMM). Nota: Las versiones de software que han alcanzado el Fin de Soporte Técnico (EoTS) no se evalúan."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "F5",
"product": "BIG-IP Next SPK",
"defaultStatus": "unknown",
"versions": [
{
"version": "2.0.0",
"lessThan": "*",
"versionType": "custom",
"status": "unaffected"
},
{
"version": "1.7.0",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "F5",
"product": "BIG-IP Next CNF",
"defaultStatus": "unknown",
"versions": [
{
"version": "2.0.0",
"lessThan": "*",
"versionType": "custom",
"status": "unaffected"
},
{
"version": "1.1.0",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "F5",
"product": "BIG-IP Next for Kubernetes",
"defaultStatus": "unknown",
"versions": [
{
"version": "2.0.0",
"lessThan": "2.1.0",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-16T03:56:47.985251Z",
"id": "CVE-2025-54805",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.1.0",
"versionEndIncluding": "1.4.1",
"matchCriteriaId": "3222CE1A-3C23-40FC-9331-370F6BA1CDCC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_next_for_kubernetes:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AB9960E8-26E9-48E2-A398-7076A8B994DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.7.0",
"versionEndIncluding": "1.9.2",
"matchCriteriaId": "4C7328B4-B7E0-460E-8270-116FE813FB23"
}
]
}
]
}
],
"references": [
{
"url": "https://my.f5.com/manage/s/article/K000151596",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}